Learning Ransomware Response & Recovery

Chapter 10. The Marathon

This chapter continues the ransomware crisis from Chapter 9, following Sarah at ZapMart, Maria’s bakery, Change Healthcare, and Northforge through days of sustained operations. (If you need to reference the details of these organizations, see Table 9-2.)

It’s 12 hours into the attack. You’ve survived the worst morning of your professional life. The containment call is made: systems isolated, backups secured, stakeholders aligned. The ransom decision is documented (probably “hell no,” maybe “we’re thinking about it,” definitely “get legal on the phone”). Your IRT knows who’s doing what. The EDR alerts have slowed from a screaming flood to a tense trickle. You can almost breathe again.

Almost.

Because here’s what your IRP didn’t prepare you for, what every TTX glossed over, what Sarah at ZapMart is about to discover the hard way: the crisis doesn’t end when you make the big decisions. It’s just getting started. The initial adrenaline spike that carried you through those first brutal hours is gone. It’s replaced by a grinding, exhausting realization that you’re not fighting a sprint anymore. You’re fighting a marathon, and you’re already tired.

Sarah’s store managers are calling every 20 minutes: “When can we sell again?” Maria’s watching customers walk past her locked bakery doors, heading to the place down the street. Change Healthcare’s nurses are handwriting medication charts on clipboards they haven’t touched in a decade, and somewhere, a patient is ...